EUVD-2026-12940Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Lifecycle Timeline
4DescriptionCVE.org
pkgutil.get_data() did not validate the resource argument as documented, allowing path traversals.
AnalysisAI
The pkgutil.get_data() function in CPython fails to properly validate the resource argument, enabling path traversal attacks that allow unauthorized information disclosure. This vulnerability affects CPython across multiple versions and could permit attackers to read arbitrary files from the system where Python code is executing. A patch is available from the Python Software Foundation, and the vulnerability has been documented with proof-of-concept references in the official CPython repository.
Technical ContextAI
The vulnerability exists in Python's pkgutil module, specifically in the get_data() function which is designed to retrieve package resource data. The function is documented to validate resource paths to prevent directory traversal, but this validation was not properly implemented. The root cause falls under CWE path traversal categories, where insufficient input validation allows attackers to use special characters or sequences (such as ../ or absolute paths) to access files outside the intended resource directory. This affects CPython (cpe:2.3:a:python_software_foundation:cpython:*:*:*:*:*:*:*:*), which is the reference implementation of the Python programming language used by millions of developers and deployed in countless applications.
RemediationAI
Apply the patch available from the Python Software Foundation immediately by upgrading to the patched CPython version as specified in the official security advisory (https://mail.python.org/archives/list/security-announce@python.org/thread/WYLLVQOOCKGK73JM7Z7ZSNOJC4N7BAWY/). The patch has been merged into the CPython repository at https://github.com/python/cpython/pull/146122. Until systems can be patched, code review should identify all uses of pkgutil.get_data() and implement additional input validation on the resource argument to ensure only whitelisted, non-traversal paths are accepted. Applications should also apply the principle of least privilege to limit file system access available to Python processes.
CPython decompression modules (lzma, bz2, gzip) allow memory corruption via use-after-free when decompressor instances a
Denial of service in CPython's tarfile module allows remote attackers to trigger an infinite loop by supplying a crafted
Stack-based buffer overflow in CPython's bz2.BZ2Decompressor allows remote attackers to crash Python applications by sen
Path traversal in CPython's tarfile module allows a crafted tar archive to bypass the 'data' and 'tar' extraction filter
Command injection in CPython's webbrowser.open() API bypasses previous CVE-2026-4519 mitigation via specially crafted UR
The webbrowser.open() API in CPython accepts URLs with leading dashes, which certain web browsers interpret as command-l
Path traversal in CPython's tarfile module allows malicious tar archives to bypass the data_filter safety mechanism and
XML parsers in CPython's xml.parsers.expat and xml.etree.ElementTree modules use insufficient entropy for Expat hash-flo
Denial-of-service via quadratic algorithmic complexity in CPython's unicodedata.normalize() affects all CPython versions
Server-Side Request Forgery in CPython's ftplib module allows a malicious FTP source server to redirect a target FTP ser
Privilege escalation in CPython on Windows enables a low-privileged local user to hijack the module search path of a mor
Config file injection in CPython's configparser module allows an attacker who controls multi-line values written via con
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today